Use

Case Histories to

Safety

Energize Your HAZOP

Glenn E. Mahnken,
FM Global

T
Photos:
2000 Factory
Mutual Insurance
Company. Reprinted
with permission.

he process safety management programs of many companies include

formal process hazards analyses,
using methods such as hazard and
operability (HAZOP) studies and
what-if reviews, as key elements
of these programs. Kletz (1) summarizes the purpose of a HAZOP as follows: ... to provide a
final check on a basically sound process design,
to make sure that no unforeseen effects have
been overlooked. To find the latent design deficiencies that could lead to hazards or operability
problems in the field, a team of highly motivated,
knowledgeable, and experienced individuals engages in a collective critical thinking process that
is guided by a methodical standard procedure.
By definition, the HAZOP team that thinks
more critically (or creatively) will be the more

Reviewing incident reports at a

HAZOP meeting is more than just
a lessons learned activity. It can
spur sharper thinking and lead
to a more telling analysis of your
processes.
likely to discover the unforeseen effects that
might result in a preventable major accident. As
noted, the team is working with a basically sound
design, so the sought after effects are often quite
subtle. To find as many of these as possible, the
team must energetically probe and challenge the
process design and be able to sustain its efforts
over many hours of questioning and answering.

CEP

March 2001

www.aiche.org/cep/

73

Safety
Table 2. Selected case histories from the AIChE Loss Prevention Symposia (1971 2000).
Author(s)

Title

Year

Incident type

Consequences

R. C. Dartnell, Jr.
and T. A. Ventrone

Explosion of a Para-NitroMeta-Cresol Unit

1971

Unexpected thermal degradation of PNMC

caused the rupture of a 3,000 gal stainless steel
storage tank into five pieces inside a building.

Fire, explosion damage to

building, injuries, one
fatality.

A. H. Searson

Fire in a Catalytic
Reforming Unit

1971

Corrosion as a result of a process change led to

rupture of piping and release of hydrocarbons.

Vapor cloud explosion

and major fire, injuries.

T. J. R. Stephenson
and C. B. Livingston

Explosion of a Chlorine
Distillate Receiver

1972

Hydrogen formed in a corrosive environment

where Cl2 concentration was low, then carried
over into the process where Cl2 concentration
was high. The vapors ignited due to unknown
ignition source.

Chlorine receiver blew

apart into five pieces, also
causing extensive damage
to nearby equipment.

T. A. Kletz

Case Histories on
Loss Prevention

1973

Maintenance was underway to add a branch

line to a steam main, which had not been
adequately isolated from a process vent
prior to welding.

When the welder cut into

the steam main, an
explosion occurred.

T. A. Kletz

Emergency Isolation Valves

for Chemical Plants

1975

Gasket on a level connection for a

reactor burst suddenly, allowing the
release of polypropylene vapor, which
ignited after about 20 min, probably due to
buildup of static electricity in the cloud.

Despite 4,0005,000 gpm

water deluge, the fire
spread to neighboring units
causing considerable
material damage.

S. A. Saia

Vapor Clouds and Fires in

a Light Hydrocarbon Plant

1976

During shutdown due to power failure,

a 24 in. bellows expansion joint failed,
allowing 15,000 gal of polypropylene to to
escape. Vapor cloud traveled 250300 ft
to furnaces and ignited within about 2 min.

Sprinkler systems
contained the fire toTrain 2.

A. L. M.
vanEinjnatten

Explosion in a Naphtha
Cracking Unit

1977

Upsets during startup caused high level/low

temperature in a feed drum, resulting in cold
brittle fracture of a weld. Loss of containment
of polypropylene. Vapor cloud ignited.

14 fatalities, 106 injuries.

V. G. Geishler

Major Effects from Minor

Features in Ethylene Plants

1978

Power failure caused control valves to shut.

Thrust forces on pipe caused control loop
supports to puncture the pipe, resulting in
loss of containment of flammable liquid.

Fire, property damage,

business interruption.

T. A. Kletz

Organisations Have No
Memory

1979

Operator opened the door to a pressure

filter that was still under pressure.

Operator was killed.

S. J. Skinner

Explosive Evolution of Gas

in Manufacture of Ethyl
Polysilicate

1980

Reactants had different densities and did

not mix initially. Gas bubbles evolved by
reaction at interface caused mixing and
runaway acceleration of the reaction.

Cover was blown off the

reactor and the plant was
enveloped in hydrogen
chloride fumes.

D. R. Pesuit

Dust Explosions in Storage

Silos: Polyvinyl Alcohol

1981

Electrostatic discharge during unloading of

polymer from a tanker truck into a silo.
Operation had operated without incident
for many years.

Explosion: silo swung over

in flames onto the top of the
truck and the transfer line.

R. E. Sanders

Plant Modifications
Troubles and Treatment

1982

No flow of oil when a process heater was

fired up and the safeguards had been
field-adjusted out of range.

6 in. dia. tube ruptured and

allowed 1,800 gal of oil to
escape. Fire ensued and
caused substantial property
damage.

T. O. Gibson

Learning Value from a

Recent Loss

1983

Electrical fault in an indoor transformer

containing 235 gal of mineral oil.

Oil fire spread to electrical

cables and into the control
room. Caused emergency
evacuation of the control
room. A $17.6 million loss.

D. J. Lewis

A Review of Some
Transportation Accidents,
Identification of Causes and
Minimization of Consequences

1986

High pressure caused a cryogenic ethylene

tanker truck to explode. It was parked near an
alcohol unloading rack. The cause was
considered to be freezing of the safety relief valve.

The tanker rocketed.

Alcohol fire.
Vapor cloud explosion.

74

www.aiche.org/cep/

March 2001

CEP

Author(s)

Title

Year

Incident type

Consequences

P. G. Snyder

Brittle Fracture of a High

Pressure Heat Exchanger

1987

Combination of deviations lead to brittle fracture

at 3,400 psig during hydrostatic pressure testing
of a steam generator following an outage.

No injuries. Refinery
production was curtailed
to 6070% for 4 mo.

R. F. Schwab

Explosion and Fire at a

Phenol Plant

1988

High temperature as a result of a leaking

steam valve, in conjunction with abnormal
conditions that arose during process
restart, caused explosion of a 25,000 gal
tank containing cumene hydroperoxide.

Phenol Unit 1 was almost

completely destroyed by fire.
Severe damage to adjacent
Unit 3. Fuel tank fire.

T. O. Gibson

Learning Value from a

Blown Fuse

1989

Blown fuse in instrumentation power supply

caused series of abnormal conditions, including
high condensate level in a steam drum, which
overflowed into the steam header. Condensate
was introduced into a hot 20 in. dia. line when a
steam valve was opened.

The line ruptured.

Three people were sprayed
with steam and condensate.
Two fatalities.

B. W. Bailey

Iron Fire in Heat

Recovery Unit

1990

High temperatures occurred as a result of an

electrical short in control wiring while gas
turbine was on turning gear. The short
caused fuel valves to open and ignition
transformer to energize.

Fuel gas burned inside the

combustor exhaust duct.
The 600 psig heat recovery
unit caught fire and was
destroyed.

S. E. Anderson
and R. W. Skioss

More Bang for the Buck:

Getting the Most from
Accident Investigations

1991

High temperature and runaway reaction

occurred in a rail tank car containing a
load of methacrylic acid that was
insufficiently inhibited.

Car exploded. Parts were

found 300 yards away.
Overhead electrical lines
were severed, shutting
down production.

D. J. Leggett

Management of a Reactive
Chemicals Incident:
Case Study

1992

Wrong material was loaded into a

chemical barge.

Incompatible reactive
chemicals mixed. 4872 h
state of alert. Near miss.

M. L. Griffin and
F. H. Garry

Case Histories of Some

Power and Control-based
Process Safety Incidents

1993

High gas flow to a reactor resulted when an

air-to-open valve suddenly went to the full open
position (as a result of a plugged orifice in the
valve positioner).

Gas vented into the area

of the reactor.

W. E. Clayton and
M. L. Griffin

Catastrophic Failure of a
Liquid Carbon Dioxide
Storage Vessel

1994

High temperature occurred in a tank containing

30 m.t. CO2, when an internal heater failed "on."
The high temperature resulted in high pressure.
The relief valve on the tank failed to open.

The tank exploded.

Three fatalities, $20 million
property damage, 3 mo.
lost production.

R. E. Sherman,
K. C. Crawford,
T. M. Cusick, and
C. S. Czengery

Carbon-initiated Effluent Tank

Overpressure Incident

1995

High temperature (hot spot) developed in

a carbon bed absorber connected to the
vent line of a 1,000 bbl intermediate
effluent storage tank.

The vent stream was in the

flammable range, ignited
and propagated back to the
storage tank. The tank roof
was blown off (~200 ft).

S. Mannan

Boiler Incident Directly

Attributable to PSM Issues

1996

Low water level occurred in a

high-temperature boiler in a process plant
due to failure to follow proper procedures
and failure of the low-level interlock.

The boiler was dry fired.

Serious internal damage
to boiler and steam drum.
No injuries (near miss).

D. S. Hall and
L. A. Losee

Carbon Disulfide Incidents

DuringViscose Rayon
Processing

1997

High level of carbon disulfide liquid during a

cleaning operation resulted in overflow into the
heating zone and sudden volatilization of the liquid.

Explosion blew out a

wall. Extensive fire in the
ductwork. Minor injuries.

F. P. Nichols

Air Compressor Delivery

Pipeline Failure

1998

Low flow of air from one of the cylinders of a

double-acting reciprocating air compressor
resulted in high temperature and concentration
of lubricating oil mist in the air stream.

The air stream ignited and

an explosion propagated a
"galloping detonation" in the
compressed air pipeline.

H. L. Febo

Plastics in Construction
The Hidden Hazard

1999

High temperature occurred in the plastic

duct and scrubber due to loss of
quenching for the hot flue gases when a
pulp mill recovery boiler tripped offline
and interlocks failed.

All plastic duct work destroyed,

scrubber collapsed onto
cable tray. Mill was shut down
for extended period. Property
damage over $5 million.

Y. Riezel

Fixed Roof Gas-Oil Tank

Explosion

2000

More hydrogen was present than was

expected in the gas-oil stream sent from
a hydrogen desulfurizing unit to a
15,000 m3 storage tank.

The tank exploded as a result

of electrostatic discharge
during a sampling operation.
One fatality. Massive fire in
storage dike.

CEP

March 2001

www.aiche.org/cep/

75

Safety
Table 1. Case history synopsis hypothetical HAZOP worksheet (in hindsight).
Company: ABC
Facility: XYZ Plant
Process: Waste Gas Incinerator
Design Intent: Burn AOG and SVG off-gases

Study-Section: 2.1 SVG piping: fan to incinerator

HAZOP Date:
Leader/Scribe:
Team Members:

HAZOP
Item No.

Deviation

Cause

Consequences

Engineering/
Administrative
Controls

F* C* R*

Questions/
Recommendations

2.1.1

No flow

Valves L and K
closed improperly

(1) Increase
concentration of
combustible gases
in SVG piping.

Operators
follow
procedures for
shutdowns.

2.1.1.1
Check procedures for Valves L and K
Are procedures clearly documented?
Do procedures cover abnormal situations?

(2) Potential
explosion if gas
goes into explosive
range and gas
reaches incinerator.

High
concentration
alarm.

2.1.1.2
Check gas alarm response time
is it fast enough?

Bypass SVG
to flare on
high: high gas
concentration alarm.

2.1.1.3
Check bypass response time vs.
travel time to incinerator.

Flame arrestor.

2.1.1.4
Review flame arrestor design vs.
expected blast pressures.

Damage-limiting
construction.

2.1.1.5
Review flame arrestor design vs.
expected reaction forces.

* F = frequency; C = consequence severity; R = risk ranking.

How case histories can help

Clearly, a variety of psychological factors come into
play that can encourage or hold back the HAZOP team
during deliberations (2). The intent is to help encourage
critical thinking by making short presentations of previous
chemical process industries (CPI) plant accidents to the
team (3). Of course, as a general prerequisite for the success of any HAZOP, the participants must already own the
process (4), i.e., the team members must have a strong
sense of urgency and be highly motivated by virtue of their
roles and responsibilities as process designers, plant engineers, supervisors, operators, and technicians. In this context, case history presentations can be made at the start of a
meeting, or during a break to help engage and galvanize
the team by telling a short war story and, at the same
time, demonstrating the connection between HAZOP
guidewords and real world accidents.
The immediate benefit of the case history presentation
is not quantifiable in terms of the HAZOP output; one simply surmises that a properly designed 10-minute presentation can be worthwhile, because a group with an accident
example fresh in their minds will be more critical and more
creative in their deliberations through the course of the
study. A long-term benefit, assuming case history presentations become an integral part of the plants HAZOP sessions, is that participants will gradually accumulate a body
of loss experience and invaluable loss-prevention wisdom

76

www.aiche.org/cep/

March 2001

CEP

based upon reported CPI plant losses. This benefit is not

quantifiable either; it relates to the value of learning any
kind of history that we desire to avoid repeating. In this respect, the HAZOP session affords a unique opportunity to
present these history lessons to busy engineers and plant
personnel who generally are not easy to assemble for such
purposes.

Use a synopsis presentation format

HAZOP meeting time is almost inevitably in short supply. And, since the main intent of presenting the case history is not to study the details of the accident, but rather to
help energize the critical thinking process, a synopsis presentation format is most appropriate. In the context of the
study, providing the basic sequence of events of the accident, along with a flow schematic, selected loss lessons and
key conclusions will suffice as long as these are offered
in a manner that engages the interest of the team. The presentation can also include a hypothetical HAZOP worksheet page that illustrates how the accident might have
been foreseen in a HAZOP study. This worksheet serves as
a minitraining example for new participants and a refresher
for those with previous such experience. Of course, the
reasons for making the case history presentation also need
to be explained to the group at the start of the presentation.
The person presenting the case history need not be the
group leader or the same individual. Team members can take

Figure. 1. Source slide.

Case History Synopsis

Based on the paper:

Figure 5. Cause slide.

Flashback from Waste Gas Incinerator

into Air Supply Piping
S. E. Anderson, A. M. Dowell, III, P.E.,
and J. B. Mynaugh
Rohm and Haas Texas, Inc.
P.O. Box 672
Deer Park, TX 77536
Paper 73c prepared for presentation at the
25th Annual AIChE Loss Prevention Symposium,
August 18-22, 1991

Initial Cause
Field operators misunderstood radio instructions from the
control room to close the AOG valve to the incinerator
Valve L was closed by mistake and Valve K was being
opened
SVG was blocked in: VOCs increased
Valve L was then reopened, sending the SVG to the
incinerator, which flashed back

Figure 6. Consequences slide.

Consequences (Partial list)

Figure 2. Summary slide.

Accident Summary
Miscommunication between outside operators and
control room resulted in closing the wrong valve
A waste gas incinerator experienced a flashback with
a pressure wave in the supply piping
Damage to flame arrestor, piping, fan, and the incinerator

SVG flame arrestor was broken from its mounting

bolts and sheared into 2 pieces
Stainless steel piping connecting the SVG flame
arrestor to SVG fan was broken free from its supports
and came to rest on top of the fan
Explosion was not stopped by the flame arrestor
Incinerator had numerous radial cracks in the
refractory brick

AOG
Waste Gases
from Process

Waste Gas
Incinerator

SVG piping going up to reactor rack fell from the

third level to the ground
Plastic (FRP) piping connected to the SVG fan suction
was sheared and broken

Valve L

Missile damage to incinerator bustle

Vent Gases (SVG)

from Process
Valve K

To SVG Flare

SVG Fan

The manual wheel for Valve K was broken off at the

gear box casing
No injuries But, at the time of the explosion, an
operator was holding onto the wheel for Valve K

Figure 3. Schematic slide.

Figure 7. Conclusions slide.

Some Conclusions
Figure 4. Process slide.

Process Description

Unusual circumstances of human factors,

unsteady-state events, and a rapid challenge combined to overcome the well-designed safety systems.

Waste gas incinerator burns off-gases from two

separate sources: AOG and SVG

Much of the serious damage was the result of

poor construction.

SVG stream is normally routed to the waste gas incinerator at less than 10% of the lower explosive limit (LEL)

Consult the original paper for additional findings

and many recommendations that have general
application for this type of equipment.

At 25% LEL, an alarm sounds

At 50% LEL, the SVG stream bypasses to the flare

CEP

March 2001

www.aiche.org/cep/

77

Safety

A fire could
cost you ...
turns being assigned a case history as prework to
study before the meeting, and, using already prepared overhead slides or handouts, make the presentation to the rest of the team at a convenient
break in the meeting. The original case history article should preferably be familiar to the presenter
beforehand, but discussion of the accident details
should be minimal. The original article can be
made available to interested participants for followup reading outside of the meeting.

Example presentation
A well-known case history paper describing a
waste-gas-incinerator explosion at a chemical
plant was presented at the 25th annual AIChE
Loss Prevention Symposium (5). As described in
the original paper, the accident evolved as follows: The AOG process, which supplied one of
the two waste gas streams feeding into an incinerator, shut
down safely and tripped offline. The incinerator remained
in operation, burning waste gas from a second process,
called SVG. In preparing the AOG line for a restart, operators accidentally closed the wrong valves, resulting in
the SVG gas flow being blocked in. The control room operator received a low SVG flow alarm and radioed to the
field operators to reopen the SVG valve to the incinerator.
The SVG flow to the incinerator was quickly restored and
an explosion occurred, resulting in overpressure damage to
the incinerator refractory, as well as the dislocation of piping, valves, a flame arrestor, and the main SVG blower.
Fortunately, there were no injuries to the operators who
were working in the vicinity of the explosion.

Literature Cited
1. Kletz, T., Hazop and Hazan: Identifying and Assessing Process Industry Hazards, 4th ed., Taylor & Francis, London, p. 34 (1999).
2. Leathley, B., and D. Nicholls, Improving the Effectiveness of
HAZOP: A Psychological Approach,Loss Prevention Bulletin, Issue
No. 139, p. 8 (1998).
3. Mahnken, G., et al., Using Case Histories in PHA Meetings,
Paper 6c, presented at AIChE 34th Annual Loss Prevention Symposium, Atlanta (Mar. 69, 2000).
4. Kletz, T., Hazop and Hazan: Identifying and Assessing Process Industry Hazards, 4th ed., Taylor & Francis, London, p. 33 (1999).
5. Anderson, S. E., et al., Flashback from Waste Gas Incinerator into
Air Supply Piping, Paper 73c, AIChE 25th Annual Loss Prevention
Symposium, Pittsburgh (Aug. 1821, 1991).
6. Loss Prevention on CD ROM, AIChE, New York (1998). The set
contains presentations from all 31 Loss Prevention Symposia sponsored by AIChEs Safety and Health Division from 1967 to 1997,
plus early CCPS conference and workshop proceedings from 1987
through 1994. (See www.aiche.org/pubcat.)
7. Kletz, T., What Went Wrong: Case Histories of Process Plant Disasters, 4th ed., Gulf Publishing, Houston (1998).
8. Sanders, R. E., Chemical Process Safety: Learning from Case Histories, Butterworth Heineman, Boston (1999).

78

www.aiche.org/cep/

March 2001

CEP

more than
you know.

A synopsis of this accident, prepared in a slide format

intended for presentation to HAZOP groups, is given in
Figures 1 through 7. Table 1 represents a hypothetical
HAZOP worksheet that predicts the accident (in perfect
hindsight, of course). The worksheet attempts to demonstrate to the team how, by using critical thinking and following HAZOP methodology, they might have been able to
identify some of the possible causes and consequences, as
well as develop the corresponding action items to help prevent or mitigate an actual accident.

Sources of accident case history reports

The annual AIChE Loss Symposium Papers (6) include
many accident case history studies that are detailed and,
often, written first hand by the accident investigators or participants. Table 2 is a selected list of these reports from
19712000 that can be used in the manner described above.
Other sources are available as well, such as case historybased loss prevention books (7, 8), loss prevention journals,
e.g., the Loss Prevention Bulletin, and published investigative reports. A good source of these reports is the U.S.
Chemical Safety and Hazard Investigation Board, Washington, DC. The CSB allows downloading of its investigation
CEP
reports at www.csb.gov.

< Discuss This Article! >

To join an online discussion about this article
with the author and other readers, go to the
ProcessCity Discussion Room for CEP articles
at www.processcity.com/cep.

G. E. MAHNKEN is a loss prevention specialist with FM Global (formerly known as Factory

Mutual), Norwood, MA ((781) 440-8000 ext. 8644; Fax: (781) 440-8718; E-mail:
glenn.mahnken@fmglobal.com). He has been with the company for 15 years, and
holds a BA in biology from Antioch College and a BS in chemical engineering from the
National Technical University of Athens, Greece. He is a member of AIChE.